In computing, phishing is a form of social engineering, characterized by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business. The objective is to lure a user to connect and present authentication credentials to an illegitimate party who masquerades as another. Sometimes, the phisher fools the user by sending an apparently official electronic communication, such as an email or an instant message. The term phishing arises, in part, from the use of increasingly sophisticated lures to “fish” for users' financial information and passwords.
More recent phishing attempts have started to target the customers of banks and online payment services. While the first such examples were sent indiscriminately in the hope of finding a customer of a given bank or service, recent research has shown that phishers may in principle be able to establish what bank a potential victim has a relationship with, and then send an appropriate spoofed email to this victim. In general, such targeted versions of phishing have been termed spear phishing.
The damage caused by phishing ranges from loss of access to email to substantial financial loss. This style of identity theft is becoming more popular, because of the ease with which unsuspecting people often divulge to phishers personal information, including credit card numbers and social security numbers. Once this information is acquired, the phishers may use a person's personal information to create fake accounts in a victim's name, ruin a victim's credit, or even prevent victims from accessing their own accounts.
In one type of phishing attack, known as a man-in-the-middle attack, an attacker tricks a client into pointing his or her browser at the attacker's login page. In such scenarios, the attacker sends an e-mail message to the client, asking the client to login to a Web site posing as a legitimate corporate site. Next, the client logs into the attacker's site, thus divulging the client's authentication credentials. The attacker then uses the client's authentication credentials to login to the legitimate corporate site.
Some phishing vulnerabilities can be mitigated by use of a One-Time Password (OTP). Unlike a conventional password, an OTP has only a limited usefulness to an attacker. In a common scenario, a time-based OTP is only valid for a few minutes, such as that provided by RSA's SecurID® system, as is known to those skilled in the art. A secure server executes security software which validates a particular OTP. If a phisher discovers the value of the OTP, then the phisher cannot store the value for later reuse, because the OTP's usefulness quickly expires. Rather, the phisher must exploit the OTP immediately and launch an attack. Some OTP systems increase the difficulty of an attack by providing additional security controls which limit the acceptance of an OTP to a single use even within the limited validity period. However, the use of a OTP does not completely solve the Phishing issue. For example, an attacker may obtain use of an OTP a single time.
In a common man-in-the-middle scenario, an attacker relays an entire session between the client and the legitimate server. While in the middle, the attacker views the entire session, harvesting account numbers and possibly other important information. Upon acquiring this information, the attacker can potentially interact with the legitimate server directly. With reference to FIG. 1, there is shown an exemplary man-in-the-middle attack. FIG. 1 illustrates that the client 100 attempts to connect to a server 110. Unfortunately, a phisher 11 (acting in the role of man-in-the-middle) captures the entire session and thereby discovers confidential information. The phisher 11 opens a channel to the server 110 and simply copies everything that it receives from either the client 100 or the server 110 into its own unauthorized log 19. First, the client 100 mistakenly connects to the phisher 11 and sends authentication credentials 10. The server copies the message that it receives into the unauthorized log 19, and forwards an exact copy of the message to the server 110 in message 12. The server 110 authenticates and responds 14. The phisher 11 copies the response into the unauthorized log 19, and returns the response 13 to the client 100. The client subsequently interacts 15, and the phisher 11 captures all information and copies into the unauthorized log 19, and forwards the interactions 16 to the server 110. The server 110 also sends interaction responses 16 which the phisher 11 copies to the unauthorized log 19 and returns the interactions 15 to the client 110. Eventually, the client 100 finishes the interaction and logs out 17, and the phisher copies the logout message to the unauthorized log 19 and sends the logout 18 to the server 110. The final result of the session is that the client performed all work as intended without detecting any attack. The phishers, however, has captured all information transmitted in the session and stored that information in an unauthorized log 19.
Thus, there is a need for an improved system and method for providing security against phishing attacks. Embodiments of the invention serve to protect against attacks such as that described above with respect to the description of FIG. 1.
Two-factor authentication is a means by which a peer may authenticate to another party by presenting two or more of the following: something the user knows, e.g., a password; something the user has, e.g., physical possession of an authentication device; and something the user is, e.g., a thumb print. Three-factor authentication is a means which requires an additional factor beyond two-factor authentication such as a biometric.
Two-factor authentication, however, typically employs a conventional password coupled with a stronger form of authentication, such as, for example, a OTP on a token. In such an arrangement, the purpose of the password is to protect the authentication mechanism in the case that the user loses the stronger authentication factor (e.g., if the user loses an OTP token), and then the password protects against the possibility of usage by the attacker.
The factors in a multiple-factor authentication may be either static or dynamic as follows: a static credential factor, otherwise called a static credential, remains constant until the owner of the static credential explicitly participates in an event which changes the credential in a meaningful way. For example, a password is a static credential. If the user wishes to change the password, the user must explicitly initiate the change password process.
A dynamic factor, otherwise called a dynamic credential, changes automatically. The following are examples of dynamic credentials:
OTP: a one-time-password automatically changes upon each use. An exemplary OTP is the password provided by an RSA SecurID® token (numbers or letters that appear on the token's screen). The value displayed by the token changes periodically, and the servers ensure that they do not accept a single token value more than once per period. Another example is a list of passwords. After the user submits one password from the list to the server, the servers are configured such that the user must submit a password that appears later in the list in a subsequent authentication event.
In a multiple-factor authentication mechanism, suppose an attacker were to discover the value of a dynamic credential without knowing the value of the corresponding static credential. In this case, the attacker could not successfully login because the attacker would not know the value of the static credential. Knowledge of the dynamic credential would become useless at the event in which the dynamic credential changes value. For example, suppose an OTP were accepted by the server for three minutes. Further suppose that the attacker were to discover the value of the dynamic credential. In this case, the attacker must discover the value of the static credential before the expiration of the three-minute time window in order to use the dynamic credential in a meaningful way. Otherwise, at the expiration of the three-minute time window, the attacker's knowledge of the expired dynamic credential value would become useless. Multiple-factor authentication requires at least two factors.
Mutual authentication is a means in which peers in a communication each authenticate the other. If a first peer communicates with a second peer, then the first peer requires that the second peer provide credentials. Once validated by the first peer, these credentials demonstrate the second peer's identity. Additionally, the second peer requires that the first peer provide credentials. Once validated by the second peer, these credentials demonstrate the first peer's identity.